Obsolete
Status Update
Comments
vi...@google.com <vi...@google.com>
xu...@gmail.com <xu...@gmail.com> #3
Oh, and I'm seeing this on both the emulator and a Galaxy Nexus. Simply launching an activity that does something like this is enough to reproduce:
ClipboardManager manager = (ClipboardManager) getSystemService(CLIPBOARD_SERVICE);
manager.addPrimaryClipChangedListener(new ClipboardManager.OnPrimaryClipChangedListener() {
@Override
public void onPrimaryClipChanged() { }
});
ClipboardManager manager = (ClipboardManager) getSystemService(CLIPBOARD_SERVICE);
manager.addPrimaryClipChangedListener(new ClipboardManager.OnPrimaryClipChangedListener() {
@Override
public void onPrimaryClipChanged() { }
});
xu...@gmail.com <xu...@gmail.com> #4
Could you please give full steps to reproduce, including the app to run that is causing it? The crash here shows it failing when setting the clipboard, which generally works; I need to to be able to see more specifically what this particular app is doing.
Also the API demo "Clipboard/Data Types" does use addPrimaryClipChangedListener() and doesn't have this problem, and the stack crawl originally shown doesn't have anything about addPrimaryClipChangedListener() in it, so there is some information I am missing.
Thanks!
Also the API demo "Clipboard/Data Types" does use addPrimaryClipChangedListener() and doesn't have this problem, and the stack crawl originally shown doesn't have anything about addPrimaryClipChangedListener() in it, so there is some information I am missing.
Thanks!
xu...@gmail.com <xu...@gmail.com> #5
What application are you trying to copy text from after adding a listener? I'm copying text from other apps like Messaging or Search and not the application the listener itself is from.
I have no idea if I'm on the right track, but my personal hypothesis is that this is caused because AppOpsService's uid verification is trying to verify the uid for the *listener's* application but the calling uid (Binder.getCallingUid()) is that of the application the text is being copied from. This leads to the permission check for UPDATE_APP_OPS_STATS which will obviously fail.
The code snippet I posted is basically the full "application" you should be able to reproduce this with. So this should be it:
1. Create a new Android app in $IDE_OF_CHOICE
2. Add a new OnPrimaryClipChangedListener in the onCreate of that application's activity -- it's contents don't matter
3. Install and launch the activity
4. Copy text from any other application
5. Crash.
I have no idea if I'm on the right track, but my personal hypothesis is that this is caused because AppOpsService's uid verification is trying to verify the uid for the *listener's* application but the calling uid (Binder.getCallingUid()) is that of the application the text is being copied from. This leads to the permission check for UPDATE_APP_OPS_STATS which will obviously fail.
The code snippet I posted is basically the full "application" you should be able to reproduce this with. So this should be it:
1. Create a new Android app in $IDE_OF_CHOICE
2. Add a new OnPrimaryClipChangedListener in the onCreate of that application's activity -- it's contents don't matter
3. Install and launch the activity
4. Copy text from any other application
5. Crash.
jr...@gmail.com <jr...@gmail.com> #6
I'm experiencing similar bug. for example, go to message app, tap and hold a message and copy text. the app will crash (the copy will save in clipboard though)
sa...@google.com <sa...@google.com> #7
I have the same problem, I have an app that starts observing clipboard and since I updated to 4.3 that app crashes with similar exception to this from the first post (android.permission.UPDATE_APP_OPS_STATS)
then every other app that tries to copy something crashes with this exception:
W/dalvikvm(5446): threadid=1: thread exiting with uncaught exception (group=0x419c0700)
W/clipboard(431): Exception:
W/clipboard(431): java.lang.IllegalStateException: beginBroadcast() called while already in a broadcast
W/clipboard(431): at android.os.RemoteCallbackList.beginBroadcast(RemoteCallbackList.java:229)
W/clipboard(431): at com.android.server.ClipboardService.setPrimaryClip(ClipboardService.java:165)
W/clipboard(431): at android.content.IClipboard$Stub.onTransact(IClipboard.java:62)
W/clipboard(431): at com.android.server.ClipboardService.onTransact(ClipboardService.java:123)
W/clipboard(431): at android.os.Binder.execTransact(Binder.java:388)
W/clipboard(431): at dalvik.system.NativeStart.run(Native Method)
E/AndroidRuntime(5446): FATAL EXCEPTION: main
E/AndroidRuntime(5446): java.lang.IllegalStateException: beginBroadcast() called while already in a broadcast
E/AndroidRuntime(5446): at android.os.Parcel.readException(Parcel.java:1439)
E/AndroidRuntime(5446): at android.os.Parcel.readException(Parcel.java:1385)
E/AndroidRuntime(5446): at android.content.IClipboard$Stub$Proxy.setPrimaryClip(IClipboard.java:171)
E/AndroidRuntime(5446): at android.content.ClipboardManager.setPrimaryClip(ClipboardManager.java:125)
E/AndroidRuntime(5446): at android.content.ClipboardManager.setText(ClipboardManager.java:208)
E/AndroidRuntime(5446): at com.google.android.apps.authenticator.AuthenticatorActivity.onContextItemSelected(AuthenticatorActivity.java:927)
E/AndroidRuntime(5446): at com.google.android.apps.authenticator.AuthenticatorActivity.access$200(AuthenticatorActivity.java:73)
E/AndroidRuntime(5446): at com.google.android.apps.authenticator.AuthenticatorActivity$3.onActionItemClicked(AuthenticatorActivity.java:353)
E/AndroidRuntime(5446): at android.widget.AbsListView$MultiChoiceModeWrapper.onActionItemClicked(AbsListView.java:6058)
E/AndroidRuntime(5446): at com.android.internal.policy.impl.PhoneWindow$DecorView$ActionModeCallbackWrapper.onActionItemClicked(PhoneWindow.java:2569)
E/AndroidRuntime(5446): at com.android.internal.app.ActionBarImpl$ActionModeImpl.onMenuItemSelected(ActionBarImpl.java:962)
E/AndroidRuntime(5446): at com.android.internal.view.menu.MenuBuilder.dispatchMenuItemSelected(MenuBuilder.java:735)
E/AndroidRuntime(5446): at com.android.internal.view.menu.MenuItemImpl.invoke(MenuItemImpl.java:152)
E/AndroidRuntime(5446): at com.android.internal.view.menu.MenuBuilder.performItemAction(MenuBuilder.java:874)
E/AndroidRuntime(5446): at com.android.internal.view.menu.ActionMenuView.invokeItem(ActionMenuView.java:547)
E/AndroidRuntime(5446): at com.android.internal.view.menu.ActionMenuItemView.onClick(ActionMenuItemView.java:115)
E/AndroidRuntime(5446): at android.view.View.performClick(View.java:4240)
E/AndroidRuntime(5446): at android.view.View$PerformClick.run(View.java:17721)
E/AndroidRuntime(5446): at android.os.Handler.handleCallback(Handler.java:730)
E/AndroidRuntime(5446): at android.os.Handler.dispatchMessage(Handler.java:92)
E/AndroidRuntime(5446): at android.os.Looper.loop(Looper.java:137)
E/AndroidRuntime(5446): at android.app.ActivityThread.main(ActivityThread.java:5103)
E/AndroidRuntime(5446): at java.lang.reflect.Method.invokeNative(Native Method)
E/AndroidRuntime(5446): at java.lang.reflect.Method.invoke(Method.java:525)
E/AndroidRuntime(5446): at com.android.internal.os.ZygoteInit$MethodAndArgsCaller.run(ZygoteInit.java:737)
E/AndroidRuntime(5446): at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:553)
E/AndroidRuntime(5446): at dalvik.system.NativeStart.main(Native Method)
W/ActivityManager(431): Force finishing activity com.google.android.apps.authenticator2/com.google.android.apps.authenticator.AuthenticatorActivity
or similar. Once I disabled clipboard monitoring app and rebooted Nexus 7 the copying worked for sometime.
then every other app that tries to copy something crashes with this exception:
W/dalvikvm(5446): threadid=1: thread exiting with uncaught exception (group=0x419c0700)
W/clipboard(431): Exception:
W/clipboard(431): java.lang.IllegalStateException: beginBroadcast() called while already in a broadcast
W/clipboard(431): at android.os.RemoteCallbackList.beginBroadcast(RemoteCallbackList.java:229)
W/clipboard(431): at com.android.server.ClipboardService.setPrimaryClip(ClipboardService.java:165)
W/clipboard(431): at android.content.IClipboard$Stub.onTransact(IClipboard.java:62)
W/clipboard(431): at com.android.server.ClipboardService.onTransact(ClipboardService.java:123)
W/clipboard(431): at android.os.Binder.execTransact(Binder.java:388)
W/clipboard(431): at dalvik.system.NativeStart.run(Native Method)
E/AndroidRuntime(5446): FATAL EXCEPTION: main
E/AndroidRuntime(5446): java.lang.IllegalStateException: beginBroadcast() called while already in a broadcast
E/AndroidRuntime(5446): at android.os.Parcel.readException(Parcel.java:1439)
E/AndroidRuntime(5446): at android.os.Parcel.readException(Parcel.java:1385)
E/AndroidRuntime(5446): at android.content.IClipboard$Stub$Proxy.setPrimaryClip(IClipboard.java:171)
E/AndroidRuntime(5446): at android.content.ClipboardManager.setPrimaryClip(ClipboardManager.java:125)
E/AndroidRuntime(5446): at android.content.ClipboardManager.setText(ClipboardManager.java:208)
E/AndroidRuntime(5446): at com.google.android.apps.authenticator.AuthenticatorActivity.onContextItemSelected(AuthenticatorActivity.java:927)
E/AndroidRuntime(5446): at com.google.android.apps.authenticator.AuthenticatorActivity.access$200(AuthenticatorActivity.java:73)
E/AndroidRuntime(5446): at com.google.android.apps.authenticator.AuthenticatorActivity$3.onActionItemClicked(AuthenticatorActivity.java:353)
E/AndroidRuntime(5446): at android.widget.AbsListView$MultiChoiceModeWrapper.onActionItemClicked(AbsListView.java:6058)
E/AndroidRuntime(5446): at com.android.internal.policy.impl.PhoneWindow$DecorView$ActionModeCallbackWrapper.onActionItemClicked(PhoneWindow.java:2569)
E/AndroidRuntime(5446): at com.android.internal.app.ActionBarImpl$ActionModeImpl.onMenuItemSelected(ActionBarImpl.java:962)
E/AndroidRuntime(5446): at com.android.internal.view.menu.MenuBuilder.dispatchMenuItemSelected(MenuBuilder.java:735)
E/AndroidRuntime(5446): at com.android.internal.view.menu.MenuItemImpl.invoke(MenuItemImpl.java:152)
E/AndroidRuntime(5446): at com.android.internal.view.menu.MenuBuilder.performItemAction(MenuBuilder.java:874)
E/AndroidRuntime(5446): at com.android.internal.view.menu.ActionMenuView.invokeItem(ActionMenuView.java:547)
E/AndroidRuntime(5446): at com.android.internal.view.menu.ActionMenuItemView.onClick(ActionMenuItemView.java:115)
E/AndroidRuntime(5446): at android.view.View.performClick(View.java:4240)
E/AndroidRuntime(5446): at android.view.View$PerformClick.run(View.java:17721)
E/AndroidRuntime(5446): at android.os.Handler.handleCallback(Handler.java:730)
E/AndroidRuntime(5446): at android.os.Handler.dispatchMessage(Handler.java:92)
E/AndroidRuntime(5446): at android.os.Looper.loop(Looper.java:137)
E/AndroidRuntime(5446): at android.app.ActivityThread.main(ActivityThread.java:5103)
E/AndroidRuntime(5446): at java.lang.reflect.Method.invokeNative(Native Method)
E/AndroidRuntime(5446): at java.lang.reflect.Method.invoke(Method.java:525)
E/AndroidRuntime(5446): at com.android.internal.os.ZygoteInit$MethodAndArgsCaller.run(ZygoteInit.java:737)
E/AndroidRuntime(5446): at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:553)
E/AndroidRuntime(5446): at dalvik.system.NativeStart.main(Native Method)
W/ActivityManager(431): Force finishing activity com.google.android.apps.authenticator2/com.google.android.apps.authenticator.AuthenticatorActivity
or similar. Once I disabled clipboard monitoring app and rebooted Nexus 7 the copying worked for sometime.
Description
- It's possible to build an app which scrapes clipboard the whole time without user noticing.
- There is no app permission to disallow that.
- Passwordmanagers like e.g. Keepass on Android copy passwords to clipboards.
A solution:
- Allow normal copy&paste always in editboxes on Android.
- Also allow copy new things to clipboard.
- Use a new permission to allow/disallow clipboard monitoring.
- Pasting not done within editing and user interaction can be malicious.
Comparison to iOS (privacy problem here):
Facebook app can scrape clipboard on iOS the whole time. On Android this is also possible. Both OSes do not allow control of clipboard monitoring. See details here for iOS:
Android can hopefully do better!
Android 6.0
Nexus 5